Security

Least privilege

GMG360 works as you. It can only see accounts and properties your Google account can already open. Reporting products (Analytics and Search Console) are requested as read-only.

Tokens are stored encrypted

Google refresh tokens are encrypted before they are stored. Secrets are kept in the server’s environment, not in the code. Passwords are hashed with a slow, salted algorithm. Activation keys are stored as hashes, so a database leak does not reveal them.

Revoke at any time

You can remove GMG360’s access whenever you like at myaccount.google.com/permissions. An administrator can also revoke an activation key, which ends the connection.

A record of changes

Every change made through GMG360 is logged with the tool, time, account and the change that was requested. Report content is not logged.

Safer defaults for changes

• Google Ads changes are checked with Google first and are not applied until you confirm them.
• Tag Manager changes stay in a workspace. Publishing is not available through the connector, and deleting needs an explicit confirmation.
• Analytics and Search Console cannot be modified.

Encrypted in transit

All traffic to this site and to the connector uses HTTPS.

Report a problem

If you believe you have found a security issue, email hi@abtarek.com.